Privacy Policy

1. Overview & Data Controller Identification

Veylor Systems ("Veylor", "we", "us", or "our") is dedicated to uncompromising privacy, minimal data footprint, and defense-grade data security. This Privacy Policy governs the processing of personal data collected through the Veylor Single Sign-On (SSO) identity service at https://sso.veylor.dev (the "Service").

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Veylor Systems acts as the Data Controller with respect to your universal Veylor user profile, authentication credentials, security logs, and authorization grants.

2. Information We Collect & How It Is Collected

We adhere strictly to the data minimization principle. We collect only the data necessary to securely authenticate your identity and issue OpenID Connect claims to authorized relying parties:

3. Lawful Basis for Processing

Under UK GDPR Article 6, we process your personal data under the following lawful bases:

• Contractual Performance (Art. 6(1)(b)): To provision your universal account, verify credentials, authenticate login sessions, and issue secure tokens allowing you to access relying parties (such as eGarage).
• Legitimate Interests (Art. 6(1)(f)): To enforce rate limits, prevent credential stuffing, mitigate brute-force attacks, protect cryptographic keys, and ensure the resilience of our identity infrastructure.
• Legal Obligation (Art. 6(1)(c)): To comply with applicable statutory obligations, fraud investigations, and regulatory disclosures.

4. Relying Party Data Transmission (OpenID Connect)

When you use Veylor SSO to sign into an integrated relying party (such as eGarage at https://egarageapp.uk), Veylor releases an OpenID Connect ID Token and UserInfo response containing strictly consented claims:

• sub: An opaque, unique subject identifier assigned to your account.
• email & email_verified: Your verified email address.
• name: Your registered user name.

Your password, session keys, and internal security logs are never disclosed to relying parties. Each relying party processes your identity claims according to its own privacy policy.

5. Cookie Policy & Zero Tracking Guarantee

Veylor SSO operates with a strict zero-tracking architecture:

• Strictly Necessary Technical Cookies: We only store essential first-party cookies (veylor_session, veylor_csrf, veylor_admin_session) configured with HttpOnly, SameSite=Lax, and Secure flags. Under PECR and UK GDPR, strictly necessary security cookies do not require user consent banners.
• Zero Third-Party Trackers: We do not deploy third-party advertising cookies, retargeting pixels, social media widgets, or behavioural profiling scripts.

6. Data Retention & Cryptographic Protections

All data is encrypted in transit using modern TLS 1.3 encryption and stored within secured, firewall-isolated environments.

• Tokens & Codes: Authorization codes expire after 10 minutes and are permanently purged upon exchange. Access tokens expire within 1 hour.
• Browser Sessions: Active web sessions persist for 30 days unless revoked manually by the user or terminated upon password change.
• Account Erasure: Upon account deletion, user records and associated credentials are permanently purged from active production databases within 30 days.

7. Third-Party Sub-Processors

We partner with vetted infrastructure providers bound by strict Data Processing Addendums (DPAs):

• Infrastructure Hosting: Dedicated EU/UK cloud servers.
• Transactional Email: Brevo / SMTP relay services for delivery of verification and password reset notifications.
• Google Identity: Google OAuth APIs (only invoked when you choose "Sign in with Google").

8. Your Data Subject Rights (UK GDPR)

Under UK data protection law, you possess explicit rights regarding your personal information:

• Right of Access: Request a copy of all personal identity records and active authorizations held by Veylor SSO.
• Right to Rectification: Request correction of inaccurate personal information.
• Right to Erasure ("Right to be Forgotten"): Request complete deletion of your universal identity profile.
• Right to Restrict or Object: Restrict processing under specific statutory circumstances.
• Right to Data Portability: Receive your profile data in a structured, machine-readable JSON format.

To exercise any of these rights, contact us at [email protected]. You also retain the statutory right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Contact & Inquiries

Data Protection Officer / Security Team
Veylor Systems
Email: [email protected]